Companies face welter of whistleblowing over fraud and safety

At a time when businesses’ reputations as employers are particularly vulnerable, how they deal with complaints and handle internal investigations could be key to future recovery and success, argue Polly Sprenger, Erin Shoesmith and Sarah Thomas

Andrew Gilman, the US journalist and lawyer, once said that “the secret of crisis management is not good versus bad, it’s preventing the bad from getting worse.” For many business leaders and decision-makers looking around at the risks they currently face, stopping the “bad” from getting “worse” looks like an impossible challenge.

The effect of a crisis is felt in waves, and the current pandemic is no different. In the first wave, the immediate impact for employers was the rapid re-deployment of millions of staff from on-site working to home-working, while grappling with a wholesale realignment of commercial practices, changes in revenue and funding, and staffing numbers.

The next wave poses its own challenges, and we are already feeling the effects: a steadily mounting number of new whistleblower reports necessitating internal investigations and remediation.

As Personnel Today has reported, HMRC has been inundated by whistleblowers detailing their employer’s fraudulent use of the government’s furlough scheme. Many employees have taken their stories directly to public agencies and the media, describing publicly how employers have forced them to work while on furlough, claimed furlough funds for nonexistent staff, or claimed furlough monies under the scheme without telling employees, who continue to work.

Those allegations sit alongside complaints about failure to implement safe environments for employees returning to the workplace, or for care home and medical workers operating without adequate personal protective equipment (PPE). The Health & Safety Executive has already received a significant number of calls to their hotlines where concerns have been raised directly with the UK’s national regulator and expect many more over the coming months as the economy gets back on track.

Such concerns, if serious and pose a significant risk to workers of the public, may lead to a formal investigation, closure of premises and ultimately criminal prosecution.

Employers, banks and regulators are also grappling with a growing pool of whistleblowers claiming that some are abusing the government’s three main schemes to provide guarantees to support lending to companies affected by the pandemic. The scheme designed for smaller companies and sole traders, the Bounce Back Loan Scheme, (BBLS), which has lent over £14bn to date, appears to present particular fraud risks because the Treasury has included self-certification by borrowers in order to facilitate faster lending decisions.

In the US, hundreds of billions of dollars have been approved by Congress through the Paycheck Protection Program (PPP), giving loans of up to $10m, as well as the Economic Injury Disaster Loan, which provides limited funding of up to $10,000, and these schemes are matched in most other jurisdictions affected by the coronavirus. The availability of large sums of money coupled with enormous pressure on financial institutions to push loan applications through quickly leads to the unfortunate but inevitable consequence that fraudulent applications may not be caught, as internal fraud controls within banks are designed for a slower pace in more standard conditions.

Clearly, the problem is not one unique to the UK: the US Securities Exchange Commission has disclosed that it received 4,000 complaints from mid-March to mid-May, a 35% increase on the same period in 2019. According to a Reuters report on 27 May 2020, “two factors appear to be driving the current surge in tips: the sheer scale of the crisis has sparked a wave of misconduct across all areas of the SEC’s remit, and mass unemployment has unleashed whistleblowers who may otherwise have feared retaliation by their employers.”

So as employers begin to prepare for a return to work and the government assesses the effectiveness of its furlough funding schemes, employers are seeing their whistleblowing hotlines light up with reports of alleged fraud and breaches of regulatory rules and government guidelines. The internal investigations that were expected to follow the pandemic are commencing much more quickly than anticipated.

One example was covered by the Financial Times in mid-May, reporting allegations that a number of banks had commenced internal investigations into any evidence of lending relationships being leveraged to obtain other types of mandates for borrowers. On 28 April, the UK’s financial services conduct regulator, the FCA, wrote a Dear CEO letter to lenders reminding them of their obligations with respect to market conduct and conflicts of interest rules in this area.

The uncertainty of the current climate does come with one certainty: internal investigations into whistleblower reports – whether they come directly to the company, or via a regulator, government authority or the media – are coming, and they are coming at a time when the internal teams tasked with managing those alerts may not be on site or back in their offices to gather all of the facts and evidence using an established procedure.

Anecdotally, the Global Investigations practice at Addleshaw Goddard has seen the effect much sooner than expected. In each of our three core disciplines – health and safety, fraud, and financial services regulatory investigations – the unusual circumstances we all find ourselves in has led to an increased demand for robust internal information gathering to help companies manage and respond to alerts.

While many well-prepared organisations will have a whistleblowing programme – complete with a reporting hotline, standard operating procedures for investigations, and key messaging on what misconduct employees are encouraged to report – most will not be resourced sufficiently to cope with a large wave of new alerts. This is a risky position to occupy given the prominence of Covid-19 in the news cycle: employees who are trying to raise the alert internally, but not being heard, will find a sympathetic ear in journalists who are keen to find the next story.

Wendy Addison, a former whistleblower and founder of SpeakOut SpeakUp, which works with companies and employees to facilitate better responses to whistleblower alerts, is advising employees to reach out to their employers first, before trying to get satisfaction from the media or a public body. “Before whistleblowing on your employer, first attempt to engage in a courageous conversation,” she says. “Why? Because there are many statutory hurdles that have to be overcome and workers should take specialist advice before contacting the press or using social media to raise their concerns. In this time of unprecedented change, when people are really worried about their jobs, it’s a really difficult thing to stand up and say ‘I think you’re committing fraud, employer, and I’m going to report you’.”

But if employees do attempt the “courageous conversation”, employers must not disappoint. Internal risk, compliance, legal and human resources teams should be preparing themselves and their whistleblowing responders for the alerts expected as a result of the global pandemic, with a specific focus on the matters that are likely to arise in their own organisations. And given the wide definition of protected disclosure under employment law, attention needs to be paid not just to alerts clearly labelled as whistleblowing, or made through a formal hotline, but also to whether more exploratory or tentative expressions of concern could be interpreted at a later date as whistleblows that have not been actioned, or that have caused retaliation or detriment. Unlike for some other employment law claims, there are no limits on the maximum compensation that can be awarded by the employment tribunal for claims of detriment to someone caused by their whistleblowing.

The objective of all of these professionals should be to prevent a complaint from becoming a crisis. Our best advice is to avoid crisis decision-making, by preparing in advance for the complaints we know are coming. Ensure that there is a process for concerns expressed to be escalated, even if this process, in many cases, rules them out as whistleblowing; ensure that these are logged appropriately; and that the basic procedures for conducting a methodical internal investigation can be carried out, even if staff are working remotely. Assess and balance all of the risks arising as a result of any whistleblower coming forward, including not just the company’s reputational risk, but any civil, criminal, regulatory or employment risk.

Financial Services firms regulated by the FCA will need to give particular consideration to the FCA rules on systems and controls to ensure the proper assessment of whistleblowing and the protection of whistleblowers in chapter SYSC 18 of the FCA handbook. These rules came into effect in 2016 and reflect an area of compliance risk not just for firms but for individuals subject to the Senior Managers and Certification Regime. The FCA’s requirements will need to be considered in detail alongside the employment law considerations.

But the most critical protection for managing legal and reputational risks, will be hearing employees’ concerns, providing them with a safe and trustworthy mechanism to bring their issues to the attention of management, and considering and addressing (as well as, where necessary, investigating) those concerns both big and small. There’s plenty of racket clamouring for all of our attention at the moment: make sure you can hear the whistle through the noise.

Latest HR job opportunities on Personnel Today

Browse more human resources jobs